National Security Bill (Thirteenth sitting)

Stuart C McDonald Excerpts

Committee stage
Tuesday 18th October 2022 Public Bill Committees

[Holly Lynch (Halifax) (Lab)]

It is always a pleasure to serve under your chairmanship, Mr Gray. I also welcome hon. Members back to the final day of the Committee. We welcome new schedules 1, 2 and 3, and hope that they will reflect the complex and evolving nature of state threats, and the significant technical and financial resources that provide the capability for sustained hostile activity.

For too long, our police and security services have had to use blunted tools in this regard, not designed to address adequately the challenges posed by modern day espionage. We are grateful to Counter Terrorism Policing for submitting written evidence to the Committee, and making its support for the new schedules 1, 2 and 3 very clear. Frankly, the Met provided far more in its written evidence on the rationale of these provisions than the explanatory notes accompanying the new schedules from the Government—a point made by my right hon. Friend the Member for North Durham.

The fairly non-existent explanatory notes are a constant challenge from this part of the Bill onwards, affecting later amendments, which is disappointing for all hon. Members trying to follow the detail closely. As the Minister said, Assistant Commissioner Matt Jukes said in his written evidence to the Committee:

“We have requested financial investigation powers to support our investigations in this space. To this end we have articulated a clear requirement to emulate various investigatory powers within the Terrorism Act which centre on financial investigations as well as examination of material which can be used for investigatory purposes. We are assured that these will be introduced by way of a forthcoming amendment. If so, this will further ensure that we have the tools required to successfully investigate and disrupt state threat activity.”

We welcome the new schedules, and now that the long overdue Economic Crime and Corporate Transparency Bill has been published, no doubt the new schedules are intended to work alongside some of the part 5 provisions in that legislation. Currently, terrorism disclosure orders can be made under schedule 5A of the Terrorism Act 2000. Counter Terrorism Policing has called for an explicit disclosure order for state threats, stating that it will help investigators benefit from a streamlined process, whereby one order is available to cover separate requests for information from multiple organisations, without the need to return to court. I want to push the Minister on oversight. I have made the case for an independent reviewer of all the new measures in the Bill. As those will be investigatory powers, will the Minister confirm that the investigatory powers commissioner will have responsibility for overseeing their use?

Turning to paragraphs 7 and 17 of new schedule 1, paragraph 7 outlines offences in relation to disclosure orders. Sub-paragraph (3) states that a person commits an offence if

“in purported compliance with a requirement imposed under a disclosure order, the person—

(a) makes a statement which the person knows to be false or misleading in a material particular, or

(b) recklessly makes a statement which is false or misleading in a material particular.”

By comparison, paragraph 17(1) states that a

“statement made by a person in response to a requirement imposed under a disclosure order may not be used in evidence against that person in criminal proceedings.”

I cannot quite square that off. I am keen to better understand why the information provided by a person under a disclosure order could not be used as evidence in criminal proceedings.

Before concluding, as I have said before, I accept that it is standard to refer to a police officer as “constable” in legislation, despite the fact that in doing so we are referring to police officers of any rank, not the rank of constable, which seems problematic. New schedule 1 is a prime example of where it gets messy. Paragraph 1(5) says that an appropriate officer for the purposes of these powers is either a constable or a National Crime Agency officer. It is not until paragraph 2(10) that the provision states that an appropriate officer must be a senior officer or authorised by a senior officer. Not until paragraph 9(4) does it confirm that “senior officer” must be a superintendent or above. Would it not be clearer to be explicit about the stipulated rank required to exercise certain powers at the earliest opportunity, instead of allowing for the ambiguity of the word “constable”? The last thing any of us want is for any ambiguity to be exploited by defence lawyers in the courts.

[Stuart C. McDonald (Cumbernauld, Kilsyth and Kirkintilloch East) (SNP)]

It is a pleasure to serve under your chairmanship, Mr Gray. My apologies for missing the previous Committee sitting. I can now welcome the Minister to his place at this very interesting and challenging time. I do not doubt that we wish him well. We have a tricky job in Committee today. We are looking at fairly substantial new schedules and new clauses for the first time. It would be helpful to hear what the Minister has to say about them. On the whole, we are supportive of most of what we will be discussing today, but we will have to take away what the Minister says and consider it further. Ultimately, we reserve our position until the Bill reaches its final stages in the House of Commons.

The Minister has outlined a number of case studies and scenarios to illustrate how this new clause and new schedule would work. More of that information would be really helpful to understand what the Government are getting at. With that proviso in mind, we would say that new schedule 1 seems to provide the necessary powers to investigate foreign threat activity. The Minister referenced the fact that this was based on other provisions, which is interesting to know, but I two have two or three questions about precisely what statute and provisions these measures are modelled on. Some of them seem fairly unusual, so it would be useful to know where else they can be found in order to analyse how they work there.

The Minister provided some examples of how the new clause and schedule would work. The first question is how is it to be decided that property is

“likely to be used for the purposes of foreign power threat activity”

or proceeds of that? Is that essential analysis to be based on the nature of the property, or is more required, such as intelligence about who may have had ownership or possession or some other link to it? Again, the illustrations which the Minister gave during his introductory speech may answer that question. I will have to go away and have a think about that, but the more illustrations we can have, the better. Otherwise, his scheme seems pretty reasonable.

I have a couple of questions about some of the supplementary provisions. Is there not an issue with being able to ask questions that could lead to self-incriminating answers? I think the shadow Minister almost had the opposite concern from me. She asked why that would be protected from use in a criminal trial. My question is about whether the safeguard goes far enough. The Government are basically saying that someone can be asked a question that may lead to a self-incriminating answer. There are protections elsewhere in paragraphs 8 and 17 of the new schedule about the non-use of those statements, but is this formulation used in other legislation? It would be useful to have a specific reference to a provision in another Act of Parliament.

In a similar vein, what is the thinking around ensuring that disclosure orders have effect, despite restrictions in another enactment? That seems a very broad provision. Again, is that found elsewhere in another piece of legislation? What other Acts of Parliament are going to be impacted or undermined by this? Finally, part 2 includes the provisions in relation to Scotland and how these would be put into practice. I wanted to check that there has been consultation with the Scottish Government. The broad thrust of new schedule 1 seems fine, but there are one or two questions for the Minister.

--- Later in debate ---

[Holly Lynch]

New clause 9 and new schedule 2 establish customer information orders, which authorise the police and NCA officers to obtain customer information from financial institutions. In its written submission to the Committee, for which we are all grateful, Counter Terrorism Policing has welcomed the provision, stating that it will

“enable investigators to identify accounts in relation to state threat investigations, or where an individual is using a covert account under a false identity to receive funds to use for the purposes of state threats.”

As the Minister outlined, the tool has been available to law enforcement for terrorism investigations thanks to schedule 6 to the Terrorism Act 2000, and it has been available for criminal investigations through the Proceeds of Crime Act. However, according to Counter Terrorism Policing, it has not been possible to use either Act in relation to state threats investigations, so we welcome the provision. It prompts the question of why we have not addressed this issue sooner.

Subsection (2) states that the judge may grant the order if they are satisfied that

“the order is sought for the purposes of an investigation into foreign power activity”,

and that

“the order will enhance the effectiveness of the investigation.”

We have spoken a lot about the value of an independent reviewer, and I welcome the substance of the Minister’s comments. It is worth keeping under review the threshold of a judge being satisfied that the order is sought for the purposes of investigation into foreign power activity. We cannot use these orders without good cause, but if we need them to be able to find evidence of foreign power activity, will investigators be able to satisfy a judge prior to that? It will be interesting to see how many applications are granted and rejected once we start to work with the orders. Aside from those points, I am happy with new schedule 2.

[Stuart C. McDonald]

I will make a couple of brief points. The broad thrust of the new schedule and the intention behind it seem absolutely fine, but I am interested in the tests that must be satisfied before an order is made. Under the previous schedule on disclosure orders, the judge has to be satisfied that there are reasonable grounds for suspicion, that there is substantial value in the information gained under the order and that the order would be in the public interest.

In contrast, here in new schedule 2, the judge has to be satisfied only that the order is sought for the purposes of an investigation and that it will enhance the effectiveness of that investigation. That seems a pretty low bar to allowing this pretty invasive procedure to be gone through. Why that choice of language? I guess it is modelled on the provisions that have been mentioned. I have probably not been as diligent as the shadow Minister has in doing my homework and tracking through the previous bits of legislation, and I will now do that. The information gained under these orders could be pretty intrusive, so we need to ensure we are not giving carte blanche to all sorts of intrusive investigations. I am a little bit concerned about the low level of test, compared with the test for disclosure orders.

My second, brief point is that paragraph 4 of the new schedule suggests that the person whose records are about to be trawled through can seek to vary or discharge the order. It is not clear to me how they would go about doing that, given that I suspect most orders will be made without any notice, and they can even be made by a judge in chambers. What assurance can we have that people will be able to challenge this potentially intrusive investigation?

[Tom Tugendhat]

The question as to why we have not addressed this sooner is a fair one. The UK’s investigation legislation is complex, as the hon. Member for Halifax knows only too well from the homework she has obviously done for our sittings. For example, in the Proceeds of Crime Act there are more than seven investigatory orders used in criminal and civil investigations. The consideration that has gone into this has naturally been complex, and it has required a lot of time and input. This Bill, as she knows very well, has been some years—and, indeed, some Ministers—in the making.

--- Later in debate ---

[Tom Tugendhat]

Let me be completely clear, because subsection (8) makes it completely clear: there is no requirement for a foreign power itself to register. We cannot compel foreign powers or entities to register; this is a compulsion on UK entities or individuals.

The scheme intends to increase assurance and transparency to activities being carried out for a foreign power, where the involvement of that foreign power might otherwise not be apparent. As such, we would not expect other Governments to register with the scheme in respect of activity that they themselves are undertaking. As the later “interpretation” clause will make clear, that includes any person acting in the capacity of an office holder, employee or other member of staff of the foreign power, or a person whom the Secretary of State reasonably considers to be exercising such functions.

This scheme has been designed to avoid interference with our obligations under international law regarding the diplomatic and consular relations between countries, as well as the need to protect routine Government-to-Government engagement—the official visits of officials, military and other agencies of a state, for example.

Secondly, subsection (2) sets out the definition of “arrangement”, which requires there to be direction from a specified foreign power or entity to a person. That element of direction is important because it envisages a power relationship between the specified foreign power or entity and the person. The specified foreign power or entity has told the person to carry out the activity, or arranged for it to be carried out. While in practice it is entirely likely for a direction to be delivered in the language of a request, the context of the relationship between the specified foreign power or entity and the person being directed will ultimately determine whether it falls within scope.

[Stuart C. McDonald]

What happens if an intermediary is involved? What if a designated state power says to someone locally, “You arrange for these activities”, rather than saying to someone in the United Kingdom, “I want you to undertake these activities”? That falls within the terms of the new clause. That intermediary then instructs people in the United Kingdom to undertake activities. Does that not mean there is a gap in the clause and that people in the UK undertaking those activities would not have to register anything? It would be almost impossible to enforce against that intermediary requirement to register. Is there not a potential problem there?

[Tom Tugendhat]

My understanding is that—in fact, I will come back to that when I sum up, because the hon. Gentleman has raised an interesting point.

We consider a power relationship to include, for example, where the specified foreign power or entity has formally contracted a person’s support for an activity, or where it is paying a person to deliver a service. It could also include a situation where a specified entity is making a request of its subsidiary—again, the direction might be in the language of a request, but the power relationship would make it a direction. Where such formal structures are not established, a direction should include where a person is requested to act, but through the promise of compensation or coercion—for example, future payment, benefit or favourable treatment.

To be clear, though, it would not be enough for a specified foreign power or entity to simply provide funding in support of an activity—through subsidy or donation, for example. Nor could a generic request from a specified foreign power or entity be considered a “direction”—a request made through a public communication to a large distribution or mailing list, for example.

A power relationship, whether formal or informal, is necessary to ensure that unilateral activity on the part of the person is not within scope and nor is activity that is part of a collaboration and absent a power relationship. We shall set out in guidance what we intend by a direction so that it is clear to the public and to the courts what arrangements are registrable.

An arrangement also captures where a person is to arrange for activity to be carried out at the direction of a specified foreign power or entity, as well as where the person is to carry out the activity themselves. That is to ensure that a person in a direct arrangement with a specified foreign power or entity cannot avoid registration by simply contracting out the activity to a third party, creating a degree of separation between the specified foreign power or entity and the ultimate person who will carry out the activity.

Thirdly, I turn to the definition of “control”, where a specified entity is said to be subject to foreign power control. It is important that we capture the commonly used practice of foreign powers channelling state threat activity through private entities. To capture this effectively we have defined “control” under subsection (5) as being where a foreign power holds, be it directly or indirectly, more than 25% of the shares or voting rights of the entity, or the foreign power can appoint or remove officers of the entity.

Control can also be demonstrated where the foreign power has the right to direct or control the entity’s activities, allowing the Secretary of State flexibility if foreign powers exercise other significant forms of control that fall below those thresholds. The more than 25% threshold is in line with existing legislation on substantial control over an entity.

--- Later in debate ---

That is why we need clarity on when an arrangement is registered—to prevent anyone from inadvertently committing an offence under new clause 12 and to ensure that legitimate arrangements are not stuck in limbo forever, unable to progress because of delays and backlogs in the Home Office, despite, I am sure, the best efforts of civil servants. I think it is the minimum we can expect from the Committee process to understand from the Minister exactly when a scheme is registered under these proposals.

[Stuart C. McDonald]

We are now turning to some of the most important provisions in the Bill. I do not think anybody here would argue that we do not need some sort of foreign influence registration scheme. The question for us today is, is this the right scheme? This debate gives us a lot of food for thought, and we will have to go away and think about it further. We have had the benefit of some very useful meetings with officials, for which I am extremely grateful.

I understand the thinking behind the two-tier system, with a broad primary political tier followed by a narrower but all-encompassing enhanced one. Obviously, the Minister is right about political transparency being essential and something we all support. It is the enhanced tier and how it would operate that challenges Members slightly more. Designating states or organisations for the enhanced tier will clearly be an incredibly serious issue, with profound implications for everyone impacted, as well as the diplomatic challenges highlighted by Members.

Many of the questions raised are ones that I would have asked, so for the moment I want to focus on the question I posed in my intervention, which is about precisely how this would work in circumstances where there are various intermediaries. Again, the hon. Member for Halifax made a very valid point: this could be helped by real-world case studies and examples, otherwise we are just using our imagination to try to come up with examples of how this will apply in practice, and my imagination is probably not up to the task. However, I will try to give a fairly mundane example of where this legislation might have implications.

A specified Government or institution in country X decides that they want a sympathetic professor or tech boss in the UK to try to corral some experts in a particular industry into an association or team, with the purpose of providing regular updates on developments in said industry in the United Kingdom. They might have longer-term goals for how they could use that information and these people. That seems exactly the type of situation that the clause is aimed at. At the stage that the professor or tech boss is tasked with putting together this team on behalf of Government X, he is under an obligation to register that arrangement, as I understand it. That then enables people to keep an eye on that activity, if it is thought necessary, in an attempt to stop anything untoward happening before it is too late. If he does not register, that obviously raises a big red flag, perhaps if the security services are aware of some of his other activities.

That all seems pretty straightforward. The problem is what happens if that professor or tech boss is not situated in the United Kingdom but is in country X? There seems little prospect of enforcing these rules against him in country X if he does not register the arrangement. If I have interpreted it correctly, the new clause does not put any obligation on the people in the UK who are undertaking the activity to register the arrangement. That seems to be a potential gap, because that seems a far more likely scenario than a simple instruction straight from a specified Government or company to people in the United Kingdom saying, “You do this”. There will always be intermediaries involved, and that potentially sets up a problem.

I appreciate that there will be issues with what the state of knowledge of the persons in the UK who are doing this via the intermediary might be. Other parts of the Bill, including new clause 11 itself, refer to a person who

“knows, or ought reasonably to know”.

That formulation might be used to fill the gap—if I have interpreted the measures correctly and there is a gap. Basically, my point is that if persons further down the line know full well that they will be asked to do activities for Government X—albeit via an intermediary—perhaps that obligation should be placed on them.

It is not clear how the criteria specified in new clause 12 would amount to an offence. Clearly, the intermediary would be committing an offence for arranging various activities without having registered them, but they are away in country X, so there is no chance of our enforcing the law against him or her. Are industry experts in the UK who have been corralled into the organisation by that intermediary committing an offence by undertaking activities that the intermediary has not registered? That comes down to the question of whether they are acting

“pursuant to a foreign activity arrangement”,

but it is not clear that they are. A little more clarity on that would be useful. Would it depend, for example, on their state of knowledge?

The Minister suggested that new clause 13 could close a gap, but it does not apply to Governments for a start, so it does not fill the hole that we are talking about. If it is not a Government who have been specified but another company, there are questions about whether that company would bother to comply with the measures and about how the measures would be enforced anyway.

More profound concerns about the enhanced tier, including the diplomatic issues and what impacts the measures might have on research and collaboration, have been raised by organisations such as Universities UK. The Government may well say, “That’s something we have to weigh in the balance, and if it is required for the security of the United Kingdom, tough—so be it.” However, there is provision for regulations to tailor precisely the list of activities that could be exempted on a country-by-country basis, and I would be interested to know the Government’s thinking on that.

What will be the process leading up to a decision to take this very serious step of designating either a foreign Government or another institution? I guess that there would have to be significant consultation about that—or would there? Would the list of activities that have to be registered be tailored depending on the country, or will the list be for everything?